CVE-2026-71407 is a medium severity (CVSS 5.6) stack-based buffer overflow in the WAD daemon of FortiOS 7.6.1 through 7.6.6. It applies only if the explicit proxy uses Kerberos authentication with SOCKS enabled. Fortinet's fix is FortiOS 7.6.7 or above.
What's affected
FortiOS 7.6.1 through 7.6.6. Fortinet's advisory FG-IR-26-161 lists FortiOS 8.0, 7.4 and 7.2 as not affected, and gives 7.6.7 or above as the fix for the 7.6 line.
The weakness is CWE-121, a stack-based buffer overflow. An unauthenticated attacker who can bypass stack protection and ASLR may execute code or commands in the context of the WAD daemon through crafted sockets. The condition is narrow: the explicit proxy must be configured with Kerberos authentication and SOCKS must be enabled.
The vector is AV:N/AC:H, with low impacts on each of confidentiality, integrity and availability. The score reflects the high complexity of bypassing the protections. Fortinet credits the UK National Cyber Security Centre for reporting it, and a virtual patch (FG-VD-10009617) is available through an FMWP database update.
How to check if you're exposed
On the FortiGate, read the firmware version:
get system status
Versions 7.6.1 to 7.6.6 are in range. Then check whether the conditions apply. Look at the explicit web proxy settings:
show web-proxy explicit
If set socks is not enabled, the stated condition is not met. If it is enabled, check the authentication rules and schemes for Kerberos.
Siemens has also published an advisory listing RUGGEDCOM APE1808 devices that run a FortiGate next-generation firewall before 7.6.7 as affected by a group of FortiOS CVEs that includes this one.
free in-browser dependency scan is for application dependencies, so use the device CLI for firmware.
What to do now
- Read the FortiOS version with get system status.
- Check whether the explicit proxy has SOCKS enabled together with Kerberos authentication.
- Upgrade to 7.6.7 or above using Fortinet's upgrade path tool.
- If you cannot upgrade, apply Fortinet's workarounds: disable the SOCKS proxy, or change the authentication scheme so that SOCKS does not use Kerberos.
- Consider the Fortinet virtual patch where your licensing allows it.
Why it matters
CWE-121 is a memory flaw that modern builds make hard to exploit, which is why the complexity is high. The attacker has to defeat stack protection and address randomization as well, so a reliable attack is much harder than the bug itself.
That said, this process handles proxy traffic on a security device, and a flaw reachable before authentication belongs on a firewall patch list even at a medium score. The narrow configuration condition is the real filter: it shows why inventorying which features are enabled is as useful as inventorying versions.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Am I affected if SOCKS is off?
Fortinet says the issue applies only if the explicit proxy is configured with Kerberos authentication and SOCKS enabled. Disabling SOCKS is one of its listed workarounds.
Sources
Last reviewed: 18 October 2026.
